From 1067ba01aeca72b9effffc1ca06aebe7833d8de0 Mon Sep 17 00:00:00 2001 From: Nick Nalivaika Date: Tue, 23 Jun 2026 22:19:05 +0000 Subject: [PATCH] feat(gcloud): support client certificate environment in gcloud actions and tests - Enable `use_default_shell_env` in `gcloud_secret` rule to pass host environment variables (like `CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE`) to the gcloud tool. - Pass `CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE` to bazel test in `scripts/publish`. --- scripts/publish | 2 +- tools/gcloud/secrets.bzl | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/publish b/scripts/publish index 8c585960d..b7397410c 100755 --- a/scripts/publish +++ b/scripts/publish @@ -18,7 +18,7 @@ fi bazel run @nodejs//:yarn config set registry https://us-npm.pkg.dev/artifact-foundry-prod/ah-3p-staging-npm/ bazel run //tools/registry-tools:switch_registry -- $(pwd)/yarn.lock https://us-npm.pkg.dev/artifact-foundry-prod/npm-3p-trusted/ bazel run @nodejs//:yarn install -- --frozen-lockfile -bazel test //... --build_tests_only +bazel test //... --build_tests_only --action_env=CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE # After the code is build with Airlock dependencies, we change the registry to public npmjs # to publish our npm package. diff --git a/tools/gcloud/secrets.bzl b/tools/gcloud/secrets.bzl index e456d88b4..862b9fda2 100644 --- a/tools/gcloud/secrets.bzl +++ b/tools/gcloud/secrets.bzl @@ -14,6 +14,7 @@ def _gcloud_secret_impl(ctx): "--location=%s" % ctx.attr.location, "--project=%s" % ctx.attr.project, ], + use_default_shell_env = True, execution_requirements = { "local": "1", },